[RESOLVED] Trouble Using Insert from PHP

[buckibooster]

I am new to the use of mySQL. I have created a html form that passes data to a php script that is supposed to create a connection to my database and input a single set of data. I know that it is making the connection and even getting my posted data echoed but keep getting an error for the INSERT query. Here are the relevant lines of php code:

$query = "INSERT INTO TomsList (
Date,
IP_Address,
Show,
Type,
User,
EMail,
Phone,
Division,
Location,
Title,
Description,
File1)
VALUES (
'$POST[todaysDate]',
'$POST[ipAddress]',
'$POST[showOrHide]',
'$POST[dbType]',
'$POST[Name]',
'$POST[EMail]',
'$POST[Phone]',
'$POST[Division]',
'$POST[Location]',
'$POST[Title]',
'$POST[Description]',
'$POST[file1Name]')";
$result = mysqli_query($cxn,$query) or die ("Couldn't execute query!");

Can anyone tell me what I am doing wrong? Any help you can give me will be very much appreciated.

[bradgrafelman]

Instead of echo'ing some arbitrary error message on failure, you should look into what MySQL is trying to tell you where the problem is; use mysqli_error() (manual page: [man]mysqli.error[/man]) to retrieve this message.

I suspect the problem is that you have used a MySQL Reserved Word in your query without properly escaping it.

EDIT: While it's not a "reserved word", SHOW has a special meaning in MySQL. Thus, you should properly escape database/table/column/view/etc. names that may have special meaning in SQL.

EDIT2: Also, you should know the code you have now is vulnerable to SQL injection attacks (or simply causing errors). User-supplied data should never be placed directly into a SQL query string. Instead, you must first sanitize it with a function such as mysqli_real_escape_string() (manual page: [man]mysqli.real_escape_string[/man]).

[buckibooster]

Dear Bradgrafelman:

That did it! Thanks very much!! - Bob